Analysis
- max time kernel
154s - max time network
149s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
28/09/2021, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
- Target a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe
- Size 1.1MB
- Sample210928-ld8g2abdd5
- SHA256 a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f
- MD5 6cff1bd19c5df5da153936328a210769
- SHA1 3c8f2ff0515c9c5577244a60a55d851b16f8e037
- SHA512 b7afb7984bad44b62f5ee8234aa80a8039601066a4625ac82951b57ad42cd01b88c16bd4131b4b3f92e60c1c94f6c28e8b80b9505151bdd4597c693bbd1887d1
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2656 conhost.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b2170562ddc9ebe6e81709e0b306ad9.exe conhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b2170562ddc9ebe6e81709e0b306ad9.exe conhost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\9b2170562ddc9ebe6e81709e0b306ad9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .." conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9b2170562ddc9ebe6e81709e0b306ad9 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .." conhost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
pid Process 2132 a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe 2132 a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe 2132 a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe 2656 conhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe Token: 33 2656 conhost.exe Token: SeIncBasePriorityPrivilege 2656 conhost.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2132 a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe 2656 conhost.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2656 2132 a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe 71 PID 2132 wrote to memory of 2656 2132 a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe 71 PID 2132 wrote to memory of 2656 2132 a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe 71 PID 2656 wrote to memory of 484 2656 conhost.exe 72 PID 2656 wrote to memory of 484 2656 conhost.exe 72 PID 2656 wrote to memory of 484 2656 conhost.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe"C:\Users\Admin\AppData\Local\Temp\a5d0881d225db9a7fd126ef81701dd79e48d7424f72b0c8b5bc42d2ca688904f.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE3⤵PID:484
-
-